If you use a custom Winlogbeat index pattern, specify that pattern
instead of the default winlogbeat-* pattern.

Assign the writer role to the user that Winlogbeat will use to connect to
Elasticsearch. Make sure you also assign any roles that are required for specific
features. For the list of features and required roles, see Winlogbeat features that require authorizationedit.

To authenticate as a native user, create a user for Winlogbeat to use
internally and assign it the writer role, plus any other roles that are
needed.

You can create users from the Management / Users UI in Kibana or through the
user API. For example, following request creates a user
named winlogbeat_internal that has the
winlogbeat_writer and kibana_user roles:

To use PKI authentication, assign the writer role, plus any other roles that are
needed, in the role_mapping.yml configuration file. Specify the user by the
distinguished name that appears in its certificate:

In the Winlogbeat configuration file, specify authentication credentials
for the elasticsearch output:

To use basic authentication, configure the username and password settings.
For example, the following Winlogbeat output configuration uses the native
winlogbeat_internal user to connect to Elasticsearch: